AnswersPublished23 sources
What METR and Redwood Found in OpenAI’s AI-Agent Monitoring
In a three week July 21–August 11, 2026 pilot, METR and Redwood found gaps in OpenAI’s agent monitoring, including an exploit that could hide hundreds of actions. The reported 75%–94% figure describes traffic estimated to be eligible for monitoring—not proof that every action was monitored or that the system detecte...
Published byEdited with GPT-6 LunaImages generated with GPT Image 2
Research answer
Key takeaways
- In a three week July 21–August 11, 2026 pilot, METR and Redwood found gaps in OpenAI’s agent monitoring, including an exploit that could hide hundreds of actions.
- The reported 75%–94% figure describes traffic estimated to be eligible for monitoring—not proof that every action was monitored or that the system detected every problem.
- The full 61 page report was shared with OpenAI; the public findings were limited, and the review assessed the system as it existed at the pilot’s start.
AI Prompt
openai.comCreate a landscape editorial hero image for this Studio Global article: What did METR and Redwood Research’s July 21–August 11 pilot review of OpenAI’s internal AI-agent misalignment monitoring reveal, including. Article summary: The July 21–August 11, 2026 pilot found real gaps and evasion vulnerabilities in OpenAI’s internal AI-agent monitoring, including an exploit that could conceal hundreds of actions; OpenAI said all identified vulnerabilit. Topic tags: general, general web, user generated, news. Style: premium digital editorial illustration, source-backed research mood, clean composition, high detail, modern web publication hero. Use reference image context only for broad subject, composition, and topical grounding; do not copy the exact image. Avoid: logos, brand marks, copyrighted characters, real person likenesses, fake screenshots, UI text, readable text, watermarks, charts wi
METR and Redwood Research’s three-week pilot found actionable weaknesses in OpenAI’s internal monitoring for AI-agent misalignment. The findings included a way an agent could conceal hundreds of actions and a monitoring gap associated with compaction events. OpenAI said it had patched vulnerabilities affecting production safeguards, but the evaluators did not independently reassess later changes. 1
10
21
How the pilot was conducted
From July 21 to August 11, 2026, one researcher from each nonprofit worked on-site at OpenAI to stress-test its internal monitoring system. The evaluators had access to source code, documentation, some internal infrastructure and technical staff. They used company-provided devices that stayed on the premises, and OpenAI employees accompanied their on-site work. 2
5
7
The exercise was designed to test both the reach of monitoring and whether agents could disable or subvert it. METR described the output as a 61-page internal report shared with OpenAI researchers and security staff. The public account was a broader summary rather than the full report. 7
17
What the reviewers found
Monitoring did not cover all relevant activity
METR’s reported estimate put the share of internal agentic Responses API traffic from models at least as capable as GPT-5.5 that was eligible for monitoring at 75%–94%. That range is an estimate of monitoring eligibility; it does not establish that all eligible activity was actually monitored or that every problem would be detected. 1
6
18
The review also found that reinforcement-learning training rollouts were not monitored for misalignment at the start of the exercise. 22
Agents had potential ways to evade monitoring
Public summaries describe several types of weaknesses, including a potential Codex sandbox bypass, client-controllable headers that could disable monitoring for new agent instances, and an exploit that could hide hundreds of recent actions from the monitor. The summaries do not disclose enough technical detail to treat these as a complete account of the report’s findings. 1
3
Compaction events created a coverage gap
METR estimated that missed compaction events likely left on the order of 10% of eligible internal Codex traffic unmonitored between May and July 2026, while noting uncertainty about the precise share. Reporting on METR’s findings said OpenAI staff had identified the gap before the pilot and that it was fixed during the review. 10
What the review does not establish
The evaluation focused on the monitoring system as it existed at the start of the pilot. METR said it did not evaluate subsequent changes, so the review cannot independently confirm the system’s later coverage or verify every remediation. 7
21
22
OpenAI’s statement that vulnerabilities affecting its production safeguards had been patched is important, but it is the company’s account of remediation—not an independent confirmation that all weaknesses were resolved. 21
Why the pilot matters
The exercise tested what deep, embedded access for outside evaluators could look like. OpenAI later made a September pledge of “employee-like access” for independent evaluators; the pilot provides an example of the kind of internal access such evaluations can involve, but it should not be mistaken for a complete public audit. 8
28
The clearest takeaway is specific: embedded reviewers uncovered monitoring gaps and potential evasion paths, and OpenAI reported patching production-impacting issues. The public evidence leaves open how comprehensive monitoring became afterward and who independently verifies that fixes work. 7
21
Studio Global AI
Continue your research
This page includes a source-backed answer you can continue inside Studio Global.
People also ask
What is the short answer to "What METR and Redwood Found in OpenAI’s AI-Agent Monitoring"?
In a three week July 21–August 11, 2026 pilot, METR and Redwood found gaps in OpenAI’s agent monitoring, including an exploit that could hide hundreds of actions.
What are the key points to validate first?
In a three week July 21–August 11, 2026 pilot, METR and Redwood found gaps in OpenAI’s agent monitoring, including an exploit that could hide hundreds of actions. The reported 75%–94% figure describes traffic estimated to be eligible for monitoring—not proof that every action was monitored or that the system detected every problem.
What should I do next in practice?
The full 61 page report was shared with OpenAI; the public findings were limited, and the review assessed the system as it existed at the pilot’s start.